assert-plus

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present, leaving publication origin less independently verifiable. This is a transparency weakness, but not by itself evidence that the release is unsafe.

Release historycaution

The latest release was published in January 2016, with no releases in the last 12 months. This long release gap lowers confidence in current maintenance, although the package may be stable because it is small and mature.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign of slow maintenance when combined with the old latest release.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with 11 open issues and one open pull request. This suggests limited current project activity.

Repo toolingcaution

The repository uses Make for builds but reports no security scanning tools. This is a modest transparency and assurance gap, partly offset by the package's small, dependency-free implementation.